By way of introduction, security chips are vulnerable to attacks on the physical structure of the chips. In particular, attackers seek to modify circuits in order to gain information stored in the chip and/or to change the operating characteristics of the chips to characteristics useful to the attacker. Attacks typically come in the form of probing and, more recently, focused ion beam (FIB) modification. Interconnection tracks and other circuit elements can be interrogated, or have signals injected. Circuits may be rerouted, disabled or crippled. There are many possible attacks relying on physical modification.
The most common defense to the attacks is to use a shield.
Passive shields are typically effective in preventing viewing of the circuit and making attacks more time-consuming. Passive shields may be removed, however, without affecting the operation of the device. The passive shields are often made from the upper layer of metal interconnects in a multi-layer circuit. However, a breach in the shield is not detected in passive shields.
Active shields may look similar to passive shields. However, a breach in an active shield is typically detected and normally results in disabling the chip. Circumventing an active shield is possible, but circumvention is significantly more difficult and time-consuming and is generally limited to a small number of small select areas of the chip under attack. Detailed knowledge and experience is generally required to make an active shield attack successful.
Reference is now made to FIG. 1, which is a cross-sectional view of a chip 10 undergoing a focused ion beam (FIB) backside attack. A new form of FIB attack is emerging whereby the attack is not through a front surface 12 of the chip 10 but through the silicon substrate via a back surface 14 of the chip 10. The new form of attack is generally referred to as FIB backside attack. The FIB backside attack was developed from the need for FIB to make circuit modifications to flip-chip devices or on lower metal layers of a multi-layer stacked chip. With chip designs having seven or more layers, for example, it may be easier to reach a lower metal layer, for example, via the back surface 14 than delving through many layers of interconnects from the front surface 12. A typical attack is now described below.
The chip 10 is reverse-engineered to discover the layout of the chip 10 and to identify points of the chip 10 to attack. Based on the experience of the attacker, the attacker typically selects a useful circuit node that may give the secret information needed to break the chip 10.
The chip 10 is then generally removed from a package (not shown) and preferably mounted such that the chip 10 operates normally. The preferred means of providing power and operating signals is in the form of a plurality of wire bonds 16.
The chip 10 is typically thinned from the back surface 14 to about 50 or 100 microns using a physical grinding technique.
A deep trench 18 is generally milled from the back surface 14 in the area where the attack is to take place. The chip 10 is thinned locally to a few microns (3-10 microns), stopping the thinning just as the active devices (implanted doping wells) are reached. The lateral area of the thinning is typically in the range of 50-200 microns square.
A thin layer of insulator is generally deposited in the deep trench 18 and various navigation techniques are applied to find the exact site of the attack.
A plurality of individual tracks 20 of the chip 10 are typically milled to. A plurality of metal contacts 22 are generally deposited on the individual tracks 20 for use during the attack. The tracks 20 may then be measured for secret data content or severed to disable parts of the circuit.
An active shield (not shown) is typically used to protect the front surface 12 of the chip 10 from attack. However, putting an active shield on the back surface 14 of the chip 10 to prevent attacks through the back surface 14 via the substrate is particularly difficult. The main difficulty is due to establishing communication between a processor (not shown) on the front surface 12 and the shield on the back surface 14. Communication is needed such that an attack on the back surface 14 leads to shut down of the chip 10 which is generally performed by the processor on the front surface 12. Connecting the shield on the back surface 14 with vias (not shown) to the processor on the front surface 12 must generally be made through the chip 10. The vias are therefore obvious and prone to attack, for example, but not limited to, by shorting out the vias or by imitating signals of the active shield. In addition, the vias generally need to be very deep in the chip 10 thereby making manufacture of the backside shield very difficult. Additionally, the manufacturing of the vias is generally incompatible with current processing technology.
The following references are believed to represent the state of the art:
US Published Patent Application 2001/0033012 of Kömmerling, et al.;
PCT Published Patent Application WO 01/50530 of Kömmerling, et al.;
Article entitled “Aligned room-temperature bonding of silicon wafers in vacuum by argon beam surface activation” by Hideki Takagi and Ryutaro Maeda in the Journal of Micromechanics and Microengineering on pages 290-295, volume 15, published by the Institute of Physics Publishing, UK; and
Article entitled “Silicon-to-silicon anodic bonding with a borosilicate glass layer” by Anders Hanneborg, Martin Nese and Per Øhlckers in the Journal of Micromechanics and Microengineering on pages 139-144, volume 1, published by the Institute of Physics Publishing, UK.
The disclosures of all references mentioned above and throughout the present specification, as well as the disclosures of all references mentioned in those references, are hereby incorporated herein by reference.